CVE-2026-96232

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An information disclosure vulnerability (CVE-2026-96232) has been identified in the TrueType font subsetter used by Windows Presentation Foundation (WPF), which lets a crafted font, for example one embedded in an XPS document, make WPF copy unrelated process memory, including internal memory addresses, into the font it produces.

Per CWE-125: Out-of-bounds Read, the weakness is a product that reads data past the end, or before the beginning, of the intended buffer.

This issue affects WPF on .NET 6, including NES for .NET releases up to and including 6.0.46. WPF is Windows-only. Microsoft's score does not require user interaction, which fits applications that process XPS documents or fonts from untrusted sources on their own, for example to save or print them. Leaked addresses weaken memory-layout protections such as ASLR rather than giving code execution by themselves. Microsoft's advisory lists .NET 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 WPF application on Windows at version 6.0.46 or earlier.
• Affected packages: Windows Desktop shared framework (Microsoft.WindowsDesktop.App, runtime pack Microsoft.WindowsDesktop.App.Runtime.win-x64), native code in DirectWriteForwarder.dll
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in the native TrueType subsetter (TtfDelta) inside DirectWriteForwarder.dll in .NET 6. WPF uses it to build a smaller copy of a font containing only the glyphs a document needs, through GlyphTypeface.ComputeSubset and when XPS content that embeds the font is serialized. The subsetter computes offsets from values stored in the font's own tables. With malformed tables, some of those calculations pointed outside the buffers being copied, so the subsetter read unrelated heap memory and wrote it into the output font, where it can disclose memory addresses and other process data.

The fix adds bounds and consistency checks across the subsetter's character map, glyph list, metrics and composite-glyph handling, rejecting fonts that would trigger an out-of-range read.

CVE-2026-70035, CVE-2026-70174, CVE-2026-83520, CVE-2026-87697, CVE-2026-96229, CVE-2026-96232 and CVE-2026-96234 were reported separately and are addressed together by the same WPF restrictive-XAML and XPS security update in NES for .NET 6.0.47.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected WPF applications to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET Desktop Runtime 8.0.32 or later
  • .NET Desktop Runtime 9.0.21 or later
  • .NET Desktop Runtime 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

The new checks are on by default. The Switch.MS.Internal.TtfDelta.DisableFontSecurityProtection AppContext switch turns them off for applications that cannot yet work with them, but doing so restores the vulnerable behavior and should only be a short-term compatibility measure.

Credits

Raffaello Tamagnini, Aobo Wang (@m4x_1997) and Ky0toFu (@ky0tofu), as credited in Microsoft's advisory.